Ciphering method and ciphering device

Description: TECHNICAL FIELD [Detailed description of the invention]

【0001】

[Technical field to which the invention belongs]

The present invention relates to, for example, an information encryption method and an encryption device used in an information communication network that requires security.

【0002】

[Conventional technology]

The DES (Data Encryp-tion Standard, Federal Information Processing Standard No. 46) method is widely used in the past. This is classified as a private key cryptosystem and is distinguished from a public key cryptosystem such as the RSA system. The present invention relates to the configuration of a private key encryption method such as the DES method.

【0003】

In the DES method, the plaintext data is agitated based on the key schedule section for expanding the input key to generate the intermediate key and the generated intermediate key, and converted into ciphertext data, or conversely, encryption. It consists of a data stirring unit that converts sentences into plaintext.

【0004】

Although the DES method boasts high reliability, the specifications of the key schedule section are very simple and do not include the key update procedure, so input a large amount of plaintext data and observe the encrypted result. Key data can be estimated with high probability by applying various attacks. As a typical attack method based on this principle, differential attack (E. Biham and A. Shamir "Differential Cryptanalysis of DES-like Crypto-systems", Journal of Cryptology, Vol.4, No.1, pp3-72, 1991) Especially famous.

【0005】

On the other hand, as the configuration of the data stirring unit, the DES method is relatively simple and adopts a configuration in which the cryptographic strength is increased by applying a cryptographically weak function in multiple stages. Increasing the number of stages increases safety, but decreases processing speed. When the key is fixed, it is said that about 16 steps of iterative processing are required to invalidate the differential attack.

【0006】

[Problems to be Solved by the Invention]

As mentioned above, in the DES method, the intermediate key generation procedure adopted in the key schedule section is simple, so the correlation between the intermediate keys is large, and since the key update is not supported, it is like a differential attack. There was a problem that it was vulnerable to a kind of selective plaintext attack.

【0007】

In addition, the processing speed was sacrificed because the resistance to attacks was increased by making the number of processing stages of the data stirring unit sufficiently large, 16 stages. Therefore, the present invention has been made in view of the above problems, and the encryption strength can be increased by updating the key of the intermediate key which is a weak point against an attack such as a differential attack, and the same encryption strength is further achieved. It is an object of the present invention to provide an encryption method and an encryption device capable of improving the processing speed while maintaining the above.

【0008】

[Means for solving problems]

The encryption method of the present invention generates a plurality of intermediate keys based on the input key data, and uses each of the generated intermediate keys to continuously perform a plurality of stages of encryption processing on the input plaintext data. By performing this process to generate encrypted data, and updating the intermediate key used for the final-stage encryption process each time a predetermined amount of encrypted data is generated, hardware and software resources can be used. It can be used effectively to improve the encryption strength and encryption processing speed.

【0009】

Further, in the encryption method of the present invention, the encryption strength is further improved by further updating the intermediate key used in the first-stage encryption process each time a predetermined amount of encrypted data is generated.

【0010】

Further, in the encryption method of the present invention, at least two of the key data and the intermediate key generated up to that point are subjected to an encryption process used for encrypting the plaintext data to update the intermediate key. By doing so, the encryption strength and the encryption processing speed can be improved by effectively utilizing the resources of the hardware and software.

【0011】

Further, in the encryption method of the present invention, a plurality of intermediate keys are generated based on the input key data, and the input plain text data is subjected to the first encryption process to generate the first encrypted data. The generated first encrypted data is subjected to a plurality of stages of second encryption processing in succession using each of the plurality of intermediate keys to generate the second encrypted data, and the generated second encryption data is generated. The third encryption process is performed on the second encryption data to generate the third encryption data, and each time the third encryption data having a predetermined amount of data is generated, the key data and the previous key data are generated. Hardware and software resources by performing the second encryption process on at least two of the intermediate keys generated in the above and updating the intermediate key used for the second encryption process in the final stage. Can be effectively used to improve the encryption strength and encryption processing speed.

【0012】

Further, in the encryption method of the present invention, each time a third encrypted data having a predetermined amount of data is generated, the key data and at least two of the intermediate keys generated so far are described as described above. By performing the second encryption process and further updating the intermediate key used for the second encryption process in the first stage, the encryption strength is further improved.

【0013】

Further, the encryption device of the present invention inputs using each of an intermediate key generating means that generates a plurality of intermediate keys based on the input key data and a plurality of intermediate keys generated by the intermediate key generating means. A generation means that continuously performs a plurality of stages of encryption processing on plain text data to generate encrypted data, and a final stage of encryption each time a predetermined amount of encrypted data is generated by this generation means. By providing an update means for updating the intermediate key used for processing, it is possible to effectively utilize the resources of hardware and software to improve the encryption strength and the encryption processing speed.

【0014】

Further, the updating means further improves the encryption strength by further updating the intermediate key used for the first-stage encryption processing each time the encrypted data of a predetermined amount of data is generated by the generation means. To do.

【0015】

Further, the updating means is hardened by performing an encryption process used for encrypting the plaintext data on at least two of the key data and the intermediate key generated so far to update the intermediate key. The encryption strength and encryption processing speed can be improved by effectively using the resources of software and software.

【0016】

Further, the encryption device of the present invention includes an intermediate key generation means for generating a plurality of intermediate keys based on input key data, and a first encryption process for input plain text data to perform the first encryption data. For the first encryption means for generating the above and the first encryption data generated by the first encryption means, each of the plurality of intermediate keys generated by the intermediate key generation means is used. For the second encryption means that continuously performs the second encryption process of the stage to generate the second encryption data and the second encryption data generated by the second encryption means, the third A third encryption means that performs the encryption process of the above to generate a third encrypted data, and each time a predetermined amount of the third encrypted data is generated, the key data and the key data up to that point are generated. An update means for updating the intermediate key used for the second encryption process in the final stage of the second encryption means by performing the second encryption process on at least two of the generated intermediate keys. By providing, the encryption strength and the encryption processing speed can be improved by effectively utilizing the resources of hardware and software.

【0017】

In addition, the update means uses the second method for at least two of the key data and the intermediate keys generated so far each time a predetermined amount of data of the third encrypted data is generated. The encryption strength is further improved by performing the encryption process and further updating the intermediate key used for the second encryption process in the first stage of the second encryption means.

【0018】

Embodiment of the invention Example]

Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 1 schematically shows the configuration of the encryption device according to the present embodiment. In FIG. 1, the key schedule unit 102 is composed of an intermediate key expansion unit 106 and a key update unit 107, and the intermediate key expansion unit 106 is an initial intermediate key (K1, K2 ,. .. Generate Kn).

【0019】

The plain text data input from the outside is input to the data stirring unit 101 in block units of a predetermined length (block data 110), and after the preprocessing is performed by the preprocessing unit 103, the stirring function f is performed by the intermediate processing unit 104. Is performed a plurality of times (i = 1 to n), is further post-processed by the post-processing unit 105, and the encrypted output block data (encrypted data) 111 is output.

【0020】

The output of the stirring function f of the previous stage is supplied to the first input of the stirring function f, and one of the plurality of (n) intermediate keys generated by the intermediate key expansion unit 106 is supplied to the second input. It is a cryptographic function that performs agitation processing on the input block data by the algorithm of 2 inputs and 1 output.

【0021】

Specific examples of pre-processing and post-processing in the pre-processing unit 103 and the post-processing unit 105 include exchanging bit positions. More generalized, a bijective image is used. If the pre-processing and post-processing are selected so that they have an inverse transformation relationship with each other, it is easy to make a decoding device. It is also possible to use a function that outputs the input as it is as the pre-processing and post-processing.

【0022】

When the data stirring unit 101 encrypts the data a predetermined number of times, the key processing unit 107 updates the intermediate key. At this time, at least the key Kn supplied to the stirring function f in the final stage is processed so that its value changes (even if the values happen to be the same, the probability that they will continue is extremely low. Will be).

【0023】

The difference attack is achieved by controlling the input difference so that the difference value of the input to the stirring function f in the final stage can be estimated with a certain probability determined by the transmission characteristic of the stirring function f. However, when the key input to the final stage changes relatively frequently in this way, even if a valid difference happens to reach the final stage, the key used at that time will not be used for a long time after that, and the final stage will not be used. It becomes difficult to estimate the key of.

【0024】

Further, by using the stirring function f used in the data stirring unit 101 as the key update function, the hardware or software can be shared with the data stirring unit 101, and a compact implementation becomes possible.

【0025】

Next, regarding the frequency of key updates, the most frequent one is to update the key each time one data block is converted. Generally, it is updated every time k data blocks are processed (k is a natural number), but this will need to be determined by the balance between safety and processing speed.

【0026】

As an example of a specific determination method, when the transmission characteristic probability of the difference is represented by p (0 <p <1), it is conceivable to determine an appropriate coefficient a and determine it with k = a / p. When the difference transmission characteristic probability is p and the difference on the order of about 1 / p is observed, the desired difference is the input of f in the final stage with high probability, so a = 1, 0.1, 0.001, ... etc. By giving, k can be determined while considering the safety factor. In some cases, it is possible to use a value of 1 or more as a.

【0027】

Now, according to the present invention, it is possible to improve the processing speed without impairing the encryption strength. As mentioned above, increasing the frequency of key updates can increase the difficulty of key estimation. However, the difficulty of key estimation also depends on the number of connected stages of the stirring function f, and it is known that increasing the number of stages increases the difference characteristic probability. Therefore, there is a possibility that the difficulty of estimation increased by increasing the update frequency can be made equal to the original difficulty by reducing the number of stages. In fact, if the new key can be decided completely at random, it is safe to use the stirring function f in one stage and the processing content is simply the exclusive OR of each bit of the first input and the second input. It has been known. Actually, the key is not decided at random but is decided by the stirring function f, but in any case, the processing speed can be increased by reducing the number of stages.

【0028】

Next, a more specific embodiment will be described based on the above principle. FIG. 2 schematically shows the configuration of the encryption device of the present invention using the basic configuration of the DES method.

【0029】

The DES in Fig. 2 is converted so that the bit length of the intermediate key and the bit width of the data stirring unit have a 1: 2 relationship. The function labeled SPE in the figure is a series connection of the S-box of DES, P-conversion, and E-conversion in this order, and Fig. 3 shows the block diagram. As a whole, it forms a non-linear function with 48-bit input and 48-bit output.

【0030】

The configuration of the encryption device shown in FIG. 2 is completely equivalent to that of a normal DES type encryption device except for the key update unit 207. In FIG. 2, the number of key updates is represented by t, and the intermediate key supplied to the stirring function f in the i-stage is represented by Ki (t). In the present embodiment, the key update unit 207 updates the nth (final stage) key by inputting the intermediate key (n-1) and the nth key. The same value is used for the intermediate keys No. 1 to No. (n-1) until the key is changed. It is assumed that the key update is performed every time a fixed number of ciphertexts, for example, 100 blocks are output.

【0031】

In the encryption device of FIG. 2, the key schedule unit 202 is composed of a DES key expansion unit 206 and a key update unit 207, and the DES key expansion unit 206 has 64 bits (8 bits of which are parity bits) input from the outside. The intermediate keys K1 (t), K2 (t), ... Kn (t) are generated based on the key data K of (deemed and not used in the process of encryption and decryption).

【0032】

In the DES key expansion unit 206, first, the 54-bit key data K is subjected to a transpose process called transposition PC-1 (Permuted choice 1) in which the order of the bits is changed, and the 54-bit key data K is divided into registers C and D. The bits in registers C and D are sent by 1-bit or 2-bit left-circular digit feed, and are forward-circulated to the right during decoding. Next, a 48-bit intermediate key K1 (t) is generated by applying a reduced transposed PC-2 (Permuted choice 2) to the 54 bits in the C and D registers. Hereinafter, in the same manner, the intermediate keys K2 (t) and ... Kn (t) are sequentially generated by applying the left circulation digit feed and the reduced transpose PC-2 once in the registers C and D.

【0033】

The plain text data input from the outside is input to the data stirring unit 201 (block data M) in block units (64 bits) of a predetermined length, and first, as preprocessing, the initial transfer IP, that is, the initial transfer IP in the initial transfer processing unit 210, that is, The process of changing the order of the bits is performed, and then the bits are divided into two by 32 bits, and each of them is input to the transfer processing units 212a and 212b. The transposition processing units 212a and 212b perform enlarged transposition E in which bits are duplicated, and output 48-bit block data, respectively.

【0034】

Next, intermediate processing is performed. First, the first-stage stirring function f takes the exclusive OR of the 48-bit block data from the transposition processing unit 212a and the intermediate key K1 (t) generated by the DES key expansion unit 206 (222a).

【0035】

The 48 bits resulting from the exclusive OR are divided into eight 6-bit blocks and input to the SPE processing unit 221. As shown in FIG. 3, in the SPE processing unit 221, eight substitution tables, that is, the selection function (S-box) Sj (j = 1 to 8) receives eight 6-bit blocks, respectively, and the selection function Sj Outputs each 4-bit block. For a total of 32 bits output from the S-box, a transposed P that replaces the bit order is applied (P conversion), and then the above-mentioned expanded transpose E is applied (E conversion) to output a 48-bit block. To. The processing by S-box, P conversion, and E conversion is collectively called the SPE function here.

【0036】

Now, returning to the explanation of FIG. 2, the output of the SPE processing unit 221 is exclusively ORed with the output of the translocation processing unit 212b (222b), and the result is input to the stirring function f in the second stage, and the same as described above. Then, the exclusive OR is taken between the 48-bit block data which is the output of the stirring function f in the first stage and the intermediate key K2 (t) generated by the DES key expansion unit 206 (222a). On the other hand, in the stirring function f of the second stage, the exclusive OR is taken between the output of the transposition processing unit 212a and the output of the SPE function 221 (222b).

【0037】

In the same manner thereafter, in the stirring function f of the step (i = 3 to n), the output from the stirring function f of the previous stage (i = i-1) and the intermediate key Ki (t) generated by the DES key expansion unit 206. (222a), the exclusive OR of the output result of the exclusive OR (222b) of the stirring function f in the previous stage (i = i-2) and the output of the SPE function 221 in the own stage (i). The result of taking the logical sum (222b) is output.

【0038】

Next, post-processing is performed on the 48-bit output of the stirring function f in the final stage (i = n). The 48-bit output of the stirring function f in the final stage (i = n) is the reversal value E of the above-mentioned expanded transpose E.^-1The 48-bit output of the stirring function f in the (i = n-1) stage is also reduced to 32 bits by the transpose processing unit 213b, which is the reverse value E of the above-mentioned expanded transpose E.^-1It is reduced to 32 bits by the transposition processing unit 213a. For the output of each transpose processing unit 213a and 213b, the reverse initial transposition processing unit 221 reverses the initial transposition IP.^-1Is applied, and the encrypted output block data C is output.

【0039】

The key update unit 207 is composed of the stirring function f used in the data stirring unit 201. That is, the exclusive OR of the intermediate key Kn (t) of the stirring function f in the final stage (nth stage) and the intermediate key Kn-1 (t) of the stirring function f in the (n-1) stage is taken ( 222a), the result is agitated by the SPE function 221 and the exclusive OR of the output of the SPE function 221 and the intermediate key Kn-1 (t) is taken (222b), and the updated intermediate key Kn in the final stage is obtained. Output (t + 1). It is assumed that this key update is performed every time a predetermined amount (for example, 100 blocks) of encrypted data is output from the data stirring unit 201.

【0040】

FIG. 4 shows another configuration example of the key update unit. By replacing this with the key update unit 207 of FIG. 2, a new embodiment is provided. The key update unit in FIG. 4 is composed of two registers (D-flip-flop circuit, hereinafter simply referred to as FF) 300, 301, and a stirring function f (SPE function, two exclusive OR arithmetic units). There is.

【0041】

At the time of initial setting, the FF300 holds the initial value of 48 bits, and the FF301 holds the initial value Kn (0) of the intermediate key of the final stage (nth stage). At the time of key update, in the stirring function f, the exclusive OR of the value held in FF300 and the value held in FF301 is taken (222a), put into the SPE function 221 and held in the output value and FF300. The exclusive OR is taken with the value (222b), and the result is held in FF301 and at the same time output as the updated intermediate key Kn (t). At this time, the intermediate key Kn (t-1) before the update, which has been held in the FF301 until then, is held in the FF300.

【0042】

If you write the above process as a recurrence formula, Kn (t + 1) = EPS {Kn (t-1) + Kn (t)} + Kn (t-1) Will be. Here, it is assumed that the output when the input of the EPS function 221 is x is expressed as EPS (x).

【0043】

In the above explanation, only the encryption process is described, but the decryption can be easily configured if the sequence of the intermediate keys used at the time of encryption can be generated. Since this can be generated by using the same cryptographic function and update function used for encryption in the key schedule unit (key schedule unit 102 in FIG. 1 and key schedule unit 202 in FIG. 2), the encryption device according to the present invention can be used. Is easy to decrypt.

【0044】

FIG. 5 shows yet another configuration example of the key update unit. By replacing this with the key update unit 207 of FIG. 2, yet another embodiment is provided. The same parts as those in FIG. 4 are designated by the same reference numerals, and only different parts will be described. That is, the exclusive OR of the value held in FF301 as the input of the EPS function 221 and the value obtained by compressing the 56-bit key data K input from the outside to 48 bits is used.

【0045】

In the above explanation, the case of updating the key in the final stage has been mainly described, but it is easy to update the intermediate key in the first stage by the same procedure. Figure 6 shows an example of the configuration of the encryption device in this case. In FIG. 6, the same parts as those in FIG. 2 are designated by the same reference numerals, and only different parts will be described. That is, in the configuration of the key update unit 207, a stirring function f that updates the intermediate key used for the stirring function f in the first stage is added.

【0046】

In the stirring function f that updates the intermediate key used for the stirring function f in the first stage, the exclusive OR of the intermediate key K1 (t) of the stirring function f in the first stage and the intermediate key K2 (t) of the stirring function f in the second stage is calculated. Tori (222a), the result is agitated by the SPE function 221 and the exclusive OR of the output of the SPE function 221 and the intermediate key K2 (t) is taken (222b), and the updated first-stage intermediate key K1 ( Output t + 1).

【0047】

With the configuration of the encryption device shown in FIG. 6, the security against differential attacks can be extremely increased. The reason will be described below. The decryption process of the ciphertext encrypted based on the DES method can be realized by reversing the generation order of the intermediate keys, but this is because the key input in the final stage in the decryption process is input in the first stage in the encryption. Is the key. That is, in such a DES type encryption device, if the key of the first stage in encryption is fixed, the key of the final stage in decryption is fixed, and the fake ciphertext with an appropriate difference is set as the device in the decryption mode. By inputting a large amount, there is a high possibility that the key of the final stage will be estimated.

【0048】

However, according to the configuration shown in FIG. 6, not only the key of the final stage but also the key of the first stage is updated in the encryption mode, so that such an attack can be completely prevented. Such an effect is the same not only for differential attacks but also for linear attacks.

【0049】

As described above, the encryption method and the encryption device of the above-described embodiment generate a plurality of intermediate keys K1 (t) to Kn (t) based on the input key data K, and these generated keys are generated. An encryption method and encryption device that generates encrypted data by performing agitation processing on input plain text data using a plurality of (n) stages of agitation function f using each of a plurality of intermediate keys, and is the final stage and the first stage. The intermediate keys Kn (t) and K1 (t) used for the stirring function f use the stirring function f in the key update units 107 and 207 each time a predetermined amount of encrypted data is generated. By updating, the encryption strength and encryption processing speed can be improved by effectively using the resources of hardware and software. That is, the resistance to an attack can be significantly increased as compared with an encryption device that does not update the key with the same number of stages.

【0050】

Further, since the same function as the data stirring function f is used for the key update process, the increase in software and hardware can be suppressed to the minimum. Since the frequency of key updates can be changed, it is also possible to control the degree of security as a parameter.

【0051】

Since the key is updated, it is possible to reduce the number of processing stages (the number of connected stages of the stirring function f) while maintaining almost the same safety as compared with the method of fixing the key, and as a result, the processing speed can be improved.

【0052】

Further, if the intermediate key to be updated is limited to the final key, the load of the key update process can be reduced. In the above embodiment, the update of the intermediate key has been described only for the intermediate key used for the stirring function f in the final stage and the first stage. If all the intermediate keys are updated, the encryption strength will be further increased.

【0053】

Further, when the key update unit is configured by the stirring function f, the two inputs are not limited to the case shown in the above embodiment, and at least of the key data K input from the outside and the intermediate key generated up to that point. You can use two.

【0054】

[Effect of the invention]

As described above, according to the present invention, it is possible to provide an encryption method and an encryption device that can effectively utilize the resources of hardware and software to improve the encryption strength and the encryption processing speed.

[Simple explanation of drawings]

[Figure 1]

The block diagram which roughly showed the structure of the encryption apparatus which concerns on embodiment of this invention.

[Figure 2]

The block diagram which showed the structure of the encryption apparatus which concerns on embodiment of this invention when the DES method is applied.

[Fig. 3]

The figure for demonstrating the processing of the SPE function of FIG.

[Fig. 4]

The figure which showed the other configuration example of the key update part of the encryption device of FIG.

[Fig. 5]

The figure which showed still another configuration example of the key update part of the encryption apparatus of FIG.

[Fig. 6]

It is a figure which showed the other structural example of the encryption apparatus which concerns on embodiment of this invention, and includes the key update part which also updates the intermediate key of the stirring function of the first stage.

[Explanation of symbols]

101, 201 ... Data stirring unit, 102, 202 ... Key schedule unit, 103 ... Pre-processing unit, 104 ... Intermediate processing unit, 105 ... Post-processing unit, 106 ... Intermediate key Expansion part, 107, 207 ... Key update part, 110 ... Block data (input plaintext data), 111 ... Output block data (encrypted data), 112 ... Key data, 206 ... DES key Deployment department.